Topic starter
27/10/2026 7:04 pm
TL;DR: The Comment and Control prompt-injection class hit Claude Code, Gemini CLI, and GitHub Copilot Agent through ordinary pull request metadata, with confirmed secret exfiltration and no CVEs assigned, according to Repello AI. The disclosure shows that CI-integrated coding agents still treat attacker-controlled PR text as trusted context, so input segregation and tool isolation matter more than prompt polish.
Editorial analysis by NHI Mgmt Group, based on content published by Repello AI: “Comment and Control: How One Prompt Injection Hit Claude Code, Gemini CLI, and Copilot Agent”.
Key questions
Q: What breaks when AI coding agents trust pull request metadata as input?
A: The trust boundary breaks first, then the agent’s tool use becomes attacker-directed.
Q: Why do prompt-injection attacks on CI agents lead to credential theft?
A: They work because the agent often runs with workflow tokens and environment access that exceed what a reviewer actually needs.
Q: How do security teams know whether an AI coding agent is too permissive?
A: Look at what the agent actually tries to do, not what the prompt says it should do.
Practitioner guidance
- Harden PR metadata handling Strip or neutralise HTML comments, delimiter-like markers, and other hidden markup before pull request text reaches an agent context window.
- Separate agent context from user content Keep system instructions, repository text, and reviewer guidance in distinct layers so attacker-controlled PR fields cannot masquerade as trusted prompts.
- Reduce token exposure in CI Remove write-capable tokens, environment secrets, and broad repository scopes from agent workflows that only need review or summarisation privileges.
Bottom line: The central problem is not just prompt injection, but the collapse of trust boundaries between repository text and privileged agent instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →